Level 2 exam — PHP · GUIDINEE.COM

Exam — fresh questions

12 new questions: recall (25%) + application (50%) + arbitration (25%) on PHP & the Web.
Answer everything, then click Check: your score and explanations will appear.

2.1 · Recall

1. What do $_GET and $_POST hold?

The server files The PHP error logs Data sent via GET (URL) and via POST (body), collected on the server The browser preferences

GET: data in the URL; POST: data in the body — read via the superglobals.

2.1 · Application

2. Riad displays the name entered in his form. Which line is safe?

echo stripslashes($_POST['nom']); echo '' . $_POST['nom'] . ''; echo $_POST['nom']; echo htmlspecialchars($_POST['nom'] ?? '', ENT_QUOTES, 'UTF-8');

htmlspecialchars neutralizes injected HTML/JavaScript: the output stays text.

2.1 · Arbitration

3. A colleague claims his JavaScript validation is enough and wants to drop the PHP checks. Riad's verdict?

Refuse: the client can be bypassed, only server-side validation protects Replace with screenshots of the form Accept: JavaScript covers every case Accept for small forms only

Disabled JavaScript, edited code or forged request: the client never protects.

2.2 · Recall

4. What is the difference between a cookie and a session?

Cookies need a database, sessions do not Cookies store data on the client (modifiable), sessions on the server (safe) None, they are two names for the same thing Sessions expire at once, cookies never

Trusted data in sessions (server); non-sensitive preferences in cookies.

2.2 · Application

5. Riad codes the member login. Which sequence is correct?

Put the identifier in a modifiable cookie Compare with md5 without a session Store the password in plain text then compare strings password_verify against the hash, session_regenerate_id, then $_SESSION['user_id']

Checked against the hash, regenerated ID against fixation, identity on the server.

2.2 · Arbitration

6. A member changes the id in the URL and sees another person's data. Which rule was missing?

Authorization: check the RIGHT to this resource, not just login None, that is normal use One extra cookie A bigger font

Logged in does not mean authorized: each resource controls its access.

2.3 · Application

7. Riad factors his menu duplicated across ten pages. What does he do?

He deletes the menu from the site He creates header.php once and includes it with require in each page He includes include $_GET['page'] with no checks He copies the menu an eleventh time to be safe

Write once, include everywhere: one change in a single place.

2.3 · Application

8. Riad receives an event photo via $_FILES. Which practice is correct?

Store in a folder where PHP runs for preview Trust the declared extension Check the real type and size, rename, store with no PHP execution Keep the original name and display it at once

Upload = hostile input: real type, renaming, storage with no execution.

2.3 · Arbitration

9. A colleague suggests include $_GET['page'] to load pages dynamically. Verdict?

Replace with more copy-pasting Accept: it is the recommended method Accept with a pretty theme Refuse: arbitrary file inclusion — never include a user path without strict control

A user path included without checks lets the attacker load arbitrary files.

2.4 · Recall

10. How do I correctly store and display a date?

Store in ISO format (YYYY-MM-DD) and format only for display Store 25/07/2026 and display as-is Store the weekday name in full letters Never store dates

ISO: sortable, unambiguous, the database standard; the local format is only display.

2.4 · Application

11. Riad must validate a new member's email. What does he pick?

No validation, the field is optional filter_var($email, FILTER_VALIDATE_EMAIL) — more reliable A homemade regex copied without testing A length check only

Common case = proven filter; regex reserved for specific business patterns.

2.4 · Application

12. The newsletter must go out to 500 members. Which solution?

User data injected into headers The basic mail() function in a loop A dedicated library (PHPMailer, Symfony Mailer) with authenticated SMTP Emails typed by hand one by one

Dedicated library: authentication, attachments, deliverability — locked headers.

What's next?

Score ≥ 80%: move on to Level 3 — databases (PDO, prepared statements) and object-oriented programming, building on the web foundations learned here.
Score 60-79%: revisit the failed sections (2.1 server validation, 2.2 sessions, 2.3 includes/uploads, 2.4 DateTime/filter_var) and redo the 48h challenges.
Score < 60%: rebuild Riad's project step by step (validated form, session login, factored site, dates and emails), then retake the test.
In any case: keep the web reflexes — never trust user input, htmlspecialchars before displaying, hashed passwords, uploads treated as hostile.